@farm.js/core 0.1.0-beta.16 → 0.1.0-beta.17

package/dist/server.cjs

@@ -5396,6 +5396,143 @@ var init_preload = __esm({
   }
 });
 
+// src/security.ts
+function resolveFarmSecurityConfig(input) {
+  if (input === void 0) return { csp: false };
+  if (!isPlainRecord(input)) {
+    throw new TypeError("security must be an object containing the csp option.");
+  }
+  if (Object.prototype.hasOwnProperty.call(input, "contentSecurityPolicy")) {
+    throw new TypeError(
+      "security.contentSecurityPolicy is not supported. Use security.csp instead."
+    );
+  }
+  const csp = input.csp;
+  if (csp === void 0 || csp === false) return { csp: false };
+  if (typeof csp === "string") {
+    return {
+      csp: {
+        value: validateSerializedCsp(csp),
+        reportOnly: false
+      }
+    };
+  }
+  if (!isPlainRecord(csp)) {
+    throw new TypeError("security.csp must be a policy string, false, or an options object.");
+  }
+  const reportOnly = validateReportOnly(csp.reportOnly);
+  if (Object.prototype.hasOwnProperty.call(csp, "value")) {
+    if (Object.prototype.hasOwnProperty.call(csp, "policy") || Object.prototype.hasOwnProperty.call(csp, "directives")) {
+      throw new TypeError(
+        "Resolved security.csp values cannot include policy or directives options."
+      );
+    }
+    return {
+      csp: {
+        value: validateSerializedCsp(csp.value),
+        reportOnly
+      }
+    };
+  }
+  const { policy, directives } = csp;
+  if (policy !== void 0 && directives !== void 0) {
+    throw new TypeError("security.csp accepts either policy or directives, not both.");
+  }
+  if (policy === void 0 && directives === void 0) {
+    throw new TypeError("security.csp requires a policy string or directives object.");
+  }
+  return {
+    csp: {
+      value: policy !== void 0 ? validateSerializedCsp(policy) : serializeFarmCspDirectives(directives),
+      reportOnly
+    }
+  };
+}
+function serializeFarmCspDirectives(directives) {
+  if (!isPlainRecord(directives)) {
+    throw new TypeError("security.csp.directives must be an object.");
+  }
+  const serialized = [];
+  const normalizedNames = /* @__PURE__ */ new Set();
+  for (const [configuredName, configuredValue] of Object.entries(directives)) {
+    if (configuredValue === false || configuredValue === null || configuredValue === void 0) {
+      continue;
+    }
+    const name = normalizeDirectiveName(configuredName);
+    if (normalizedNames.has(name)) {
+      throw new TypeError(`security.csp contains the duplicate directive ${JSON.stringify(name)}.`);
+    }
+    normalizedNames.add(name);
+    const values = configuredValue === true ? [] : (Array.isArray(configuredValue) ? configuredValue : [configuredValue]).map(
+      validateDirectiveValue
+    );
+    serialized.push(values.length > 0 ? `${name} ${values.join(" ")}` : name);
+  }
+  if (serialized.length === 0) {
+    throw new TypeError("security.csp.directives must contain at least one enabled directive.");
+  }
+  return serialized.join("; ");
+}
+function getFarmSecurityHeader(security) {
+  if (!security.csp) return void 0;
+  return {
+    key: security.csp.reportOnly ? "Content-Security-Policy-Report-Only" : "Content-Security-Policy",
+    value: security.csp.value
+  };
+}
+function normalizeDirectiveName(value) {
+  const name = value.trim().replace(/([a-z0-9])([A-Z])/g, "$1-$2").toLowerCase();
+  if (!/^[a-z][a-z0-9-]*$/.test(name)) {
+    throw new TypeError(`Invalid security.csp directive name: ${JSON.stringify(value)}.`);
+  }
+  return name;
+}
+function validateDirectiveValue(value) {
+  if (typeof value !== "string") {
+    throw new TypeError("security.csp directive values must be strings or booleans.");
+  }
+  const normalized = value.trim();
+  if (!normalized || /[;\r\n]/.test(normalized) || normalized.includes("\0")) {
+    throw new TypeError(`Invalid security.csp directive value: ${JSON.stringify(value)}.`);
+  }
+  return normalized;
+}
+function validateSerializedCsp(value) {
+  if (typeof value !== "string") {
+    throw new TypeError("security.csp policy must be a non-empty single-line string.");
+  }
+  const normalized = value.trim().replace(/;+$/g, "").trim();
+  if (!normalized || /[\r\n]/.test(normalized) || normalized.includes("\0")) {
+    throw new TypeError("security.csp policy must be a non-empty single-line string.");
+  }
+  return normalized;
+}
+function validateReportOnly(value) {
+  if (value === void 0) return false;
+  if (typeof value !== "boolean") {
+    throw new TypeError("security.csp.reportOnly must be a boolean.");
+  }
+  return value;
+}
+function isPlainRecord(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return false;
+  const prototype = Object.getPrototypeOf(value);
+  return prototype === Object.prototype || prototype === null;
+}
+var init_security = __esm({
+  "src/security.ts"() {
+    "use strict";
+    __name(resolveFarmSecurityConfig, "resolveFarmSecurityConfig");
+    __name(serializeFarmCspDirectives, "serializeFarmCspDirectives");
+    __name(getFarmSecurityHeader, "getFarmSecurityHeader");
+    __name(normalizeDirectiveName, "normalizeDirectiveName");
+    __name(validateDirectiveValue, "validateDirectiveValue");
+    __name(validateSerializedCsp, "validateSerializedCsp");
+    __name(validateReportOnly, "validateReportOnly");
+    __name(isPlainRecord, "isPlainRecord");
+  }
+});
+
 // src/write-file-if-changed.ts
 function writeFileIfChanged(filePath, content) {
   try {
@@ -10154,6 +10291,8 @@ async function resolveConfig(userConfig, mode) {
   const routeRules = normalizeRouteRules(userConfig.routeRules);
   const routeRuleRedirects = routeRulesToRedirects(routeRules);
   const routeRuleHeaders = routeRulesToHeaders(routeRules);
+  const security = resolveFarmSecurityConfig(userConfig.security);
+  const securityHeader = getFarmSecurityHeader(security);
   const deploy = resolveDeployConfig(userConfig);
   const root = userConfig.root || process.cwd();
   const srcDir = userConfig.srcDir || "src";
@@ -10209,7 +10348,11 @@ async function resolveConfig(userConfig, mode) {
     trailingSlash: userConfig.trailingSlash ?? false,
     redirects: /* @__PURE__ */ __name(() => [...redirects, ...routeRuleRedirects], "redirects"),
     rewrites: /* @__PURE__ */ __name(() => rewrites, "rewrites"),
-    headers: /* @__PURE__ */ __name(() => [...headers, ...routeRuleHeaders], "headers"),
+    headers: /* @__PURE__ */ __name(() => [
+      ...headers,
+      ...routeRuleHeaders,
+      ...securityHeader ? [{ source: "/*", headers: [securityHeader] }] : []
+    ], "headers"),
     routeRules,
     images: resolveFarmImageConfig(userConfig.images),
     performance: resolveFarmPerformanceConfig(userConfig.performance),
@@ -10228,6 +10371,7 @@ async function resolveConfig(userConfig, mode) {
     notFound: userConfig.notFound || {},
     context: userConfig.context || (() => void 0),
     serverActions: resolveServerActionsConfig(userConfig.serverActions),
+    security,
     deploymentId,
     output: userConfig.output || "standalone",
     distDir: userConfig.distDir || ".farm",
@@ -10307,6 +10451,7 @@ var init_config2 = __esm({
     init_config();
     init_auth_config();
     init_preload();
+    init_security();
     init_config_entry();
     FARM_RESOLVED_CUSTOM_CONTEXT = /* @__PURE__ */ Symbol.for("farm.resolvedCustomContext");
     __name(normalizeDeployTarget, "normalizeDeployTarget");
@@ -21190,6 +21335,7 @@ init_devtools_config();
 init_config();
 init_auth_config();
 init_preload();
+init_security();
 var defaultDocsConfig = {
   enabled: false,
   entry: "/docs",
@@ -21257,6 +21403,7 @@ var _FarmApp = class _FarmApp {
       routeRules: normalizeRouteRules(config.routeRules),
       context: config.context || (() => void 0),
       serverActions: resolveServerActionsConfig(config.serverActions),
+      security: resolveFarmSecurityConfig(config.security),
       images: resolveFarmImageConfig(config.images),
       performance: resolveFarmPerformanceConfig(config.performance),
       i18n: isResolvedI18nConfig(config.i18n) ? config.i18n : resolveFarmI18nConfig(config.i18n, {
@@ -23941,7 +24088,7 @@ function transformError(id, message) {
 __name(transformError, "transformError");
 
 // package.json
-var version = "0.1.0-beta.16";
+var version = "0.1.0-beta.17";
 
 // src/version.ts
 var FARM_VERSION = version;
@@ -24268,12 +24415,31 @@ function createFarmClientOptimizeDepsConfig(entries) {
   };
 }
 __name(createFarmClientOptimizeDepsConfig, "createFarmClientOptimizeDepsConfig");
+function createFarmSourceAlias(projectRoot, srcDir = "src") {
+  return {
+    "@": import_node_path9.default.resolve(projectRoot, srcDir)
+  };
+}
+__name(createFarmSourceAlias, "createFarmSourceAlias");
 function mergeNoExternal(farmValue, userValue) {
   if (farmValue === true || userValue === true) return true;
   const normalize = /* @__PURE__ */ __name((value) => value == null || value === true ? [] : Array.isArray(value) ? value : [value], "normalize");
   return Array.from(/* @__PURE__ */ new Set([...normalize(farmValue), ...normalize(userValue)]));
 }
 __name(mergeNoExternal, "mergeNoExternal");
+function mergeAlias(farmValue, userValue) {
+  if (!farmValue) return userValue || {};
+  if (!userValue) return farmValue;
+  if (!Array.isArray(farmValue) && !Array.isArray(userValue)) {
+    return {
+      ...farmValue,
+      ...userValue
+    };
+  }
+  const normalize = /* @__PURE__ */ __name((value) => Array.isArray(value) ? [...value] : Object.entries(value).map(([find, replacement]) => ({ find, replacement })), "normalize");
+  return [...normalize(userValue), ...normalize(farmValue)];
+}
+__name(mergeAlias, "mergeAlias");
 function mergeFarmViteConfig(farmConfig, userConfig = {}) {
   const noDiscovery = userConfig.optimizeDeps?.noDiscovery ?? farmConfig.optimizeDeps?.noDiscovery;
   const holdUntilCrawlEnd = userConfig.optimizeDeps?.holdUntilCrawlEnd ?? (userConfig.optimizeDeps?.noDiscovery === true ? false : farmConfig.optimizeDeps?.holdUntilCrawlEnd);
@@ -24288,6 +24454,7 @@ function mergeFarmViteConfig(farmConfig, userConfig = {}) {
     resolve: {
       ...farmConfig.resolve,
       ...userConfig.resolve,
+      alias: mergeAlias(farmConfig.resolve?.alias, userConfig.resolve?.alias),
       dedupe: Array.from(
         /* @__PURE__ */ new Set([...farmConfig.resolve?.dedupe || [], ...userConfig.resolve?.dedupe || []])
       )
@@ -28076,7 +28243,7 @@ async function defineConfig2(config = {}) {
       // Stub out problematic server-only modules during dev mode
       alias: {
         ...getFarmLayerAliases(config.layers),
-        "@": path25.resolve(appRoot, "src"),
+        ...createFarmSourceAlias(appRoot, config.srcDir),
         // Nitro internals that should not be resolved in browser
         "supports-color": "data:text/javascript,export default false; export const supportsColor = false; export const stdout = false; export const stderr = false;",
         "@poppinss/dumper": "data:text/javascript,export default {};",